Maritime Cybersecurity: Rising Threats and New Regulatory Responses

Secure IoT Office

24 Jul 2025 — 9 min read

Executive Summary

The maritime industry faces an unprecedented cybersecurity crisis that threatens global trade and national security. Critical port infrastructure, responsible for 80 percent of global trade, is increasingly under attack by threat actors tied to Russia, Iran, and China. With over 1,800 vessels targeted in the first half of 2024 alone and the Port of Los Angeles seeing cyber attacks surge from 7 million per month in 2014 to a staggering 60 million monthly attacks by 2023, the sector requires immediate and comprehensive action.

The convergence of new U.S. Coast Guard regulations, NATO strategic concerns, and sophisticated state-sponsored attacks has created a critical inflection point for maritime cybersecurity. Organizations must navigate complex new compliance requirements while defending against increasingly sophisticated threats targeting both operational technology (OT) and information technology (IT) systems.

The Growing Threat Landscape

Scale and Sophistication of Attacks

The maritime sector has become a prime target for cybercriminals and nation-state actors. Cybersecurity reports reveal a dramatic surge in maritime cyber incidents in 2024. Over 1,800 vessels were targeted in the first half of the year alone. These attacks have evolved beyond basic phishing to include:

Command & Control (C2) Attacks: Persistent access to ship systems for data theft and operational disruption
Botnet Exploits: Leveraging IoT devices to spread malware across fleets
AI-Powered Threats: Highly targeted and evasive attacks that challenge traditional defenses

Financial and Operational Impact

The financial consequences are severe, with the average cost of a cyberattack on a maritime organization now surpassing USD 550,000. Recent high-profile incidents demonstrate the operational disruption potential:

Port of Seattle (August 2024): A ransomware attack resulted in significant cargo delays and a data breach of 90,000 individuals, with critical systems, including phone networks and email services, disrupted for three weeks
DP World Australia (November 2023): Attacks disrupted operations at a key hub handling 40% of Australia's freight

State-Sponsored Threats

Nation-state actors represent the most significant threat to maritime infrastructure. Russia's APT28 (Fancy Bear), Iran's APT35 (Charming Kitten), and China's Mustang Panda have each been linked to operations targeting maritime infrastructure, using tactics that range from ransomware to surveillance and disruption campaigns.

The 2017 NotPetya attack serves as a cautionary tale. Linked to Russian military intelligence, it caused hundreds of millions in damage across shipping companies and ports, demonstrating how interconnected IT and OT systems can spread damage far beyond the original target.

Chinese Infrastructure Concerns

A particularly concerning development involves Chinese-manufactured port equipment. Over 200 Chinese-made cranes still operate in American ports, with a joint congressional probe finding installed communications equipment, such as cellular modems, that could be accessed remotely. These modems were reportedly not necessary for the capabilities required at specific ports or part of existing contracts, thereby "raising questions as to their intended applications".

New U.S. Coast Guard Regulations

The Final Rule on Cybersecurity in the Marine Transportation System

On January 17, 2025, the U.S. Coast Guard published comprehensive cybersecurity regulations that will transform maritime security requirements. This final rule is effective July 16, 2025 and applies to U.S.-flagged vessels, as well as Outer Continental Shelf and onshore facilities subject to the Maritime Transportation Security Act of 2002 ("MTSA").

Key Requirements

The regulations establish several mandatory components:

Cybersecurity Officer Appointment: Organizations must designate a Cybersecurity Officer (CySO) who will be responsible for implementing and maintaining the requirements.

Cybersecurity Plans: Owners or operators must prepare and document comprehensive cybersecurity plans that include two data security measure requirements that ensure logs are securely captured, stored, and protected and accessible only to privileged users, and deploy effective encryption to maintain confidentiality of sensitive data and integrity of IT and OT traffic when technically feasible.

Incident Response Plans: Owners or operators must prepare and document a Cyber Incident Response Plan that outlines instructions on how to respond to a cyber incident and identifies key roles, responsibilities, and decision-makers amongst personnel.

Training Requirements: All personnel must complete cybersecurity training starting on July 17, 2025, to meet the requirements. Within six months of the Final Rule's effective date, training must be conducted on recognition and detection of cybersecurity threats and all types of cyber incidents, techniques used to circumvent cyber security measures, and reporting procedures.

Cybersecurity Drills: Organizations must conduct two cybersecurity drills annually to test their readiness.

Implementation Timeline

The compliance timeline is strict:

The rule takes effect on July 16, 2025, and training must begin by July 17, 2025
Cybersecurity plans and assessments must be submitted by July 16, 2027
The USCG is accepting comments until March 18, 2025, on potential deadline extensions for U.S. flagged vessels

Enforcement and Penalties

Failure to comply could result in fines, legal action, and operational restrictions. The rule also includes provisions for limited waivers or equivalence determinations if the owner or operator demonstrates that cybersecurity requirements are unnecessary given the specific nature or operating conditions.

NATO and International Concerns

The Civil-Military Gap

A significant concern highlighted by NATO's Cooperative Cyber Defence Centre of Excellence is the disconnect between military and civilian cyber defense responsibilities. Most ports are commercially operated, yet they serve military logistics functions, making them attractive hybrid warfare targets.

Despite this, NATO's current Alliance Maritime Strategy, last updated in 2011, does not adequately account for cyber threats or include formal coordination mechanisms with commercial port operators.

NATO Recommendations

The CCDCOE policy brief recommends several critical steps:

Updating NATO's maritime strategy to integrate cyber defence
Establishing liaison roles to link NATO commands with national port cybersecurity authorities
Creating structured intelligence-sharing networks tailored to maritime threats
Developing international working groups under the International Maritime Organization to standardise cybersecurity practices across ports

Operational Technology Vulnerabilities

The IT/OT Integration Challenge

One of the most critical vulnerabilities in maritime cybersecurity lies in the integration of information technology (IT) and operational technology (OT) systems. More than half of the organizations with OT network segments held inaccurate assumptions about their network segmentation. Many believed their OT networks were isolated from the internet or unreachable from IT networks. However, assessments frequently proved otherwise, revealing exposure that went unrecognized.

First Shipboard Ransomware Incident

In 2024, the CTIME report detailed the first ransomware incident involving shipboard networks in the encryption phase. Attackers gained initial access through a password-guessing attack targeting a VPN account with a common username and weak password. They then moved laterally, exploiting unpatched backup servers with remote code execution (RCE) vulnerabilities to escalate access, exfiltrate data, and deploy ransomware across the network.

USB-Based Threats

Alarmingly, 80% of cyber incidents are initiated via USB drives essential for vessel operations, highlighting the ongoing risks posed by physical security gaps.

The Maritime Security Assessment Tool

The maritime cybersecurity assessment tool at maritime.securitycareers.help represents a practical response to the new regulatory environment. This tool helps maritime organizations evaluate their cybersecurity readiness and compliance with USCG requirements, effective July 16, 2025.

The tool provides:

Comprehensive scoring and actionable recommendations across 8 key domains
Detailed reports with prioritized recommendations for improvement
Alignment with the latest USCG cybersecurity regulations and requirements

This approach reflects the industry's need for practical compliance tools that can help organizations navigate the complex new regulatory landscape while improving their actual cybersecurity posture.

Emerging Threats for 2025

AI-Driven Attacks

The maritime industry in 2025 faces an increasingly complex and dynamic cybersecurity landscape, with artificial intelligence becoming a double-edged sword. While AI can enhance cybersecurity defenses, AI-driven attacks and OT vulnerabilities to geopolitical cyber conflicts represent new frontiers of risk.

Autonomous Systems Vulnerabilities

The adoption of autonomous vessels and automated port operations introduces new vulnerabilities. Cyber attackers may exploit unsecured software, communication systems, or autonomous drones to disrupt operations or gain control over critical systems.

Supply Chain Attacks

Supply chain attacks are also becoming a significant concern, as interconnected maritime operations present multiple points of vulnerability. These attacks can cascade through multiple organizations and systems, making them particularly dangerous for the interconnected maritime ecosystem.

Challenges and Limitations

Resource Constraints

The Coast Guard itself faces significant challenges in addressing maritime cybersecurity. In a July 2024 audit report, the Department of Homeland Security's Inspector General found that the organization lacked sufficient cyber expertise, capacity, and the necessary credibility to partner with private-sector port operators.

Industry Adoption Challenges

Despite the Coast Guard offering cybersecurity support, only 36% of maritime organizations took advantage of these services in 2022. The lack of engagement is partly due to industry hesitancy and the Coast Guard's limited authority to enforce collaboration.

Cloud Security Misconceptions

As cloud computing becomes the norm within the MTS, many organizations continue to misinterpret their security responsibilities. A persistent misconception is that cloud service providers bear full responsibility for securing data and systems.

Recommendations and Future Outlook

Immediate Actions for Maritime Organizations

Organizations should prioritize several immediate actions:

Designate Cybersecurity Officers: Begin identifying and training cybersecurity officers who can oversee compliance with new regulations.
Conduct Comprehensive Assessments: Use tools like the maritime cybersecurity assessment to understand current vulnerabilities and compliance gaps.
Implement Basic Security Measures: Technical measures must be implemented, including multifactor authentication, secure device and data management, network segmentation, resilience strategies, and supply chain security to mitigate third-party risks.
Develop Training Programs: Human factors play a crucial role in cybersecurity so training is essential.

Long-term Strategic Considerations

The maritime industry must evolve its approach to cybersecurity from reactive to proactive. The rule is performance-based, meaning organizations have flexibility in how they meet compliance standards, but they must demonstrate effectiveness in safeguarding operations.

Policy and Investment Needs

Congress should pass the bipartisan Port Crane Security and Inspection Act of 2025 to take critical steps to reduce foreign crane reliance and decrease supply chain risk. Additionally, the Biden administration also plans to invest more than $20 billion in port infrastructure and cybersecurity over the next five years.

Conclusion

The maritime industry stands at a critical juncture where cybersecurity can no longer be treated as an afterthought. The combination of sophisticated state-sponsored threats, increasing digitalization, and new regulatory requirements demands immediate and sustained action from all stakeholders.

Although many of the vulnerabilities observed in 2024 echo those found in previous CTIME reports, there has been a notable improvement in the overall cybersecurity posture across the MTS. The broader implementation of multi-factor authentication and stronger defenses against phishing attacks have played a key role in this progress.

However, the Coast Guard emphasized that maintaining effective cybersecurity requires continuous vigilance, regular updates, and a long-term commitment to improving defenses across the maritime domain.

The maritime cybersecurity assessment tool represents one practical step toward compliance and improved security, but success will require coordinated efforts across industry, government, and international partners. As the July 2025 compliance deadline approaches, organizations must move quickly to implement comprehensive cybersecurity programs that protect not just their own operations, but the global supply chain that depends on maritime infrastructure.

The stakes could not be higher: access control systems and vessel traffic management systems most often targeted. DoS attacks, data breaches, ransomware, and phishing campaigns are common. Some incidents have already caused significant disruption to maritime logistics and operations. The industry's response to these challenges will determine whether maritime infrastructure remains a critical vulnerability or becomes a model of cybersecurity resilience.